cbaja Privacy Policy
Your privacy matters to us. This Privacy Policy explains exactly what personal data cbaja collects from players in Bangladesh, why we collect it, how it is used, how long we keep it, and the rights you have over your own information. Please read it carefully before creating an account.
1 Data Controller & Contact
cbaja operates as the data controller responsible for the personal information collected through the cbaja Platform, including the website, mobile-optimised interface, and any related services accessed by players in Bangladesh. As data controller, cbaja determines the purposes for which and the means by which personal data is processed.
If you have any questions, concerns, or requests regarding this Privacy Policy or the personal data cbaja holds about you, please contact our dedicated privacy team. All privacy-related correspondence should be directed to:
Email: [email protected] — Subject line: "Privacy Request". Our team will acknowledge your request within 2 business days and provide a full response within 30 calendar days of receipt.
cbaja is committed to handling all personal data in a manner consistent with applicable data protection principles, including purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. This Privacy Policy applies to all registered players, prospective players who browse the Platform, and any individual who contacts cbaja support.
2 Information We Collect
cbaja collects personal data through several channels: directly from you when you register an account or use our services, automatically as you interact with the Platform, and in limited circumstances from trusted third-party sources for identity and payment verification purposes.
Information you provide directly:
- Registration data: Full legal name, date of birth, residential address (including city — Dhaka, Chittagong, Sylhet, Khulna, Rajshahi, or other Bangladeshi cities), email address, and mobile number.
- Identity verification (KYC): Copies of government-issued photo ID (National ID card, passport, or driving licence), proof of address, and supporting documentation required by our compliance process.
- Payment data: bKash wallet number, Nagad account number, Rocket mobile number, Upay account, Visa/Mastercard card details (card number, expiry — CVV is never stored), Dutch-Bangla Bank or BRAC Bank account references. Full card numbers are processed exclusively by our PCI-DSS compliant payment partners and are not stored on cbaja servers.
- Communications: Messages sent to our support team via email or live chat, including the content of those conversations, timestamps, and any attachments submitted.
- Responsible gaming preferences: Deposit limit settings, session time limits, self-exclusion requests, and reality-check intervals you configure in your account dashboard.
Information collected automatically:
- Device & browser data: IP address, device type, operating system, browser type and version, screen resolution, and device identifiers.
- Usage data: Pages visited, games played, bets placed, time spent on each section of the Platform, click paths, search queries entered within the Platform, and session duration.
- Transaction logs: A full audit trail of all deposits, withdrawals, bonus claims, bet placements, and game rounds completed on your account, including timestamps in Bangladesh Standard Time (BST, UTC+6).
- Geolocation data: Approximate geographic location derived from your IP address, used to ensure you are accessing the Platform from an eligible location and to detect suspicious access patterns.
- Cookie and tracking data: As described in the Cookies section of this Policy below.
Information from third parties:
- Identity verification agencies and KYC providers who assist cbaja in confirming your identity and age.
- Payment processors and mobile financial service providers (bKash, Nagad, Rocket, Upay) who confirm the status of deposit and withdrawal transactions.
- Fraud prevention and anti-money laundering screening services that flag accounts or transactions matching known risk indicators.
| Data Category | Examples | Source |
|---|---|---|
| Identity Data | Name, date of birth, NID, passport | You / KYC provider |
| Contact Data | Email address, mobile number, city | You |
| Financial Data | bKash number, Nagad account, card references | You / Payment processors |
| Technical Data | IP address, device type, browser, OS | Automatically collected |
| Usage Data | Games played, bets placed, session logs | Automatically collected |
| Communications Data | Support chat transcripts, email exchanges | You |
| Responsible Gaming Data | Deposit limits, self-exclusion status | You |
3 How We Use Your Data
cbaja uses the personal data we collect strictly for the purposes listed below. We do not sell your personal data to third parties and we do not use your data for purposes incompatible with those described in this Policy.
- Account creation and management: To register your cbaja account, verify your identity, maintain your account preferences, and provide you with access to the Platform's full range of games and betting markets.
- Age and identity verification: To confirm that you are aged 18 or above and to verify the information you have provided during registration, as required by our responsible gaming obligations.
- Processing deposits and withdrawals: To facilitate payments in BDT via bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank — and to maintain an accurate record of all financial transactions on your account.
- Fraud prevention and security: To detect, investigate, and prevent fraudulent activity, money laundering, bonus abuse, multi-accounting, and any other conduct that violates our Terms & Conditions or applicable law.
- Customer support: To respond to your queries, resolve disputes, process complaints, and provide assistance related to your account, payments, or game results.
- Responsible gaming: To monitor betting patterns that may indicate problem gambling, to apply self-exclusion settings or deposit limits you have requested, and to send responsible gaming communications where appropriate.
- Legal and regulatory compliance: To meet our obligations under applicable anti-money laundering, know-your-customer, and data protection requirements, and to respond to lawful requests from authorities.
- Platform improvement: To analyse usage patterns, diagnose technical issues, test new features, and improve the overall cbaja experience for players in Bangladesh.
- Marketing communications: To send you promotional offers, bonus notifications, and updates about new games or features — but only where you have given explicit consent to receive marketing. You may withdraw this consent at any time by contacting [email protected].
If you no longer wish to receive marketing emails or SMS messages from cbaja, contact [email protected] with the subject line "Unsubscribe" and we will remove you from all marketing lists within 5 business days. Opting out of marketing does not affect transactional or account-related communications.
4 Legal Basis for Processing
cbaja processes your personal data on one or more of the following legal grounds, depending on the specific processing activity:
- Contractual necessity: Processing required to perform the contract between you and cbaja — including account registration, payment processing, and game access — is carried out on the basis that it is necessary to fulfil our contractual obligations to you.
- Legitimate interests: Processing for fraud prevention, security monitoring, platform analytics, and responsible gaming monitoring is carried out on the basis of cbaja's legitimate interests in operating a safe, fair, and commercially viable platform — provided those interests do not override your fundamental privacy rights.
- Legal obligation: Processing required to comply with KYC, anti-money laundering obligations, and responses to lawful authority requests is carried out because cbaja is legally required to do so.
- Consent: Processing for direct marketing communications is carried out only where you have given your explicit, freely given, and informed consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.
5 Sharing Your Information
cbaja does not sell, rent, or trade your personal data with any third party for their own commercial purposes. We share your data only in the limited circumstances described below, and only to the minimum extent necessary for the stated purpose.
- Payment service providers: bKash, Nagad, Rocket, Upay, Visa, Mastercard, Dutch-Bangla Bank, and BRAC Bank receive the transaction data necessary to process your deposits and withdrawals. These providers operate under their own privacy policies and applicable financial regulations.
- KYC and identity verification providers: Third-party identity verification services receive a copy of the identification documents you submit during the KYC process in order to validate your identity and age.
- Game content providers: Providers including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Spribe, and Ezugi receive session tokens and account identifiers necessary to deliver game content to your device. These providers do not receive your full profile or payment details.
- Fraud prevention and AML screening services: Specialist third-party services receive transaction data and account metadata for the purposes of detecting and preventing financial crime.
- Legal and regulatory authorities: cbaja will disclose personal data to law enforcement agencies, regulatory bodies, or other authorised parties where required by law or where we believe disclosure is necessary to protect the safety of any individual or the integrity of the Platform.
- Corporate transactions: In the event of a merger, acquisition, or sale of cbaja's business or assets, your personal data may be transferred as part of that transaction. We will notify affected players before any such transfer takes place where required by applicable law.
All third-party service providers engaged by cbaja are required to handle personal data in accordance with applicable data protection standards and are prohibited from using your data for any purpose other than the specific service they provide to cbaja.
6 Cookies & Tracking Technologies
cbaja uses cookies and similar technologies (such as pixel tags and local storage) on the Platform to ensure it functions correctly, to remember your preferences, and to understand how players interact with our site. Below is a summary of the types of cookies we use.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Session management, login state, security tokens, language preference | Session / Up to 24 hours |
| Functional | Remembering your preferred game category, deposit method, and display settings | Up to 30 days |
| Analytics | Aggregated usage statistics — pages visited, time on site, game popularity — used to improve the Platform | Up to 12 months |
| Marketing / Targeting | Tracking which promotions you have viewed to avoid showing you the same offer repeatedly; used only with your consent | Up to 90 days |
Strictly necessary cookies cannot be disabled as they are essential to the operation of the Platform. You may manage functional, analytics, and marketing cookies through your browser settings. Most modern browsers allow you to refuse cookies, delete existing cookies, or receive a warning before a cookie is stored. Please note that disabling certain cookies may affect the functionality of the cbaja Platform.
To manage or disable cookies, access your browser's settings and navigate to the privacy or cookie management section. Instructions vary by browser. Disabling analytics or marketing cookies will not prevent you from using cbaja — it only limits our ability to personalise your experience and understand Platform usage patterns.
7 Data Retention Periods
cbaja retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, to meet our legal and regulatory obligations, and to resolve any disputes that may arise. The following retention schedules apply:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account registration data | Duration of account + 5 years after closure | Contractual and legal compliance |
| KYC / identity documents | Duration of account + 5 years after closure | Anti-money laundering obligations |
| Transaction records | Duration of account + 7 years after closure | Financial record-keeping requirements |
| Support communications | 3 years from last interaction | Dispute resolution and service improvement |
| Marketing consent records | Until consent is withdrawn + 1 year | Evidence of lawful marketing basis |
| Analytics and usage data | Up to 24 months, then aggregated/anonymised | Platform improvement |
| Self-exclusion records | Indefinitely (or until exclusion ends + 5 years) | Responsible gaming obligations |
Once the applicable retention period expires, cbaja will securely delete or anonymise your personal data so that it can no longer be associated with you. Where complete deletion is not immediately practicable due to technical constraints, the data will be isolated from active processing until it can be permanently erased.
8 How We Protect Your Data
cbaja implements a comprehensive set of technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction. Our security framework includes the following controls:
- 256-bit SSL/TLS encryption: All data transmitted between your device and cbaja's servers is encrypted in transit using industry-standard TLS 1.2 or higher. This protects your login credentials, payment details, and personal information from interception.
- Encryption at rest: Sensitive data stored on cbaja's servers — including identity documents, payment references, and account credentials — is encrypted at rest using AES-256 encryption.
- Access controls: Access to personal data within cbaja's internal systems is restricted on a strict need-to-know basis. Staff members are granted only the minimum level of access required to perform their specific role. All access is logged and audited.
- Two-factor authentication (2FA): All cbaja staff with access to personal data are required to use multi-factor authentication when accessing internal systems. Players are encouraged to enable SMS OTP verification on their accounts for additional security.
- Penetration testing and vulnerability assessments: cbaja's Platform is subject to regular security testing by qualified third-party security professionals to identify and remediate vulnerabilities before they can be exploited.
- Data breach response: cbaja maintains a documented data breach response plan. In the event of a breach affecting your personal data, cbaja will notify affected players without undue delay and take all reasonable steps to contain and mitigate the impact.
While cbaja takes all reasonable precautions to protect your personal data, no internet-based platform can guarantee absolute security. You are responsible for maintaining the security of your own account credentials and for notifying cbaja immediately if you suspect unauthorised access to your account.
9 Your Privacy Rights
As a cbaja player, you have a number of rights in relation to the personal data we hold about you. cbaja is committed to facilitating the exercise of these rights promptly and without unnecessary barriers. To exercise any of the rights described below, contact [email protected] with the subject line "Privacy Request".
Right of Access
Request a copy of the personal data cbaja holds about you (a Subject Access Request). We will provide a response within 30 calendar days.
Right to Rectification
Request correction of any inaccurate or incomplete personal data held on your account without undue delay.
Right to Erasure
Request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to legal retention obligations.
Right to Restrict Processing
Request that we limit how we use your data in certain circumstances, for example while a complaint or accuracy dispute is being resolved.
Right to Data Portability
Request a copy of the data you have provided to cbaja in a structured, machine-readable format so you can transfer it to another service.
Right to Object
Object to processing carried out on the basis of legitimate interests or for direct marketing purposes. Marketing objections are always honoured immediately.
Right to Withdraw Consent
Where processing is based on your consent (e.g., marketing), withdraw that consent at any time without affecting prior lawful processing.
Right Against Automated Decisions
Request human review of any automated decision that significantly affects you, such as an automated account restriction triggered by our fraud detection systems.
cbaja will not charge a fee for handling privacy rights requests in ordinary circumstances. Where a request is manifestly unfounded or excessive, cbaja reserves the right to charge a reasonable administrative fee or decline the request, with a written explanation provided to you.
10 Children's Privacy
The cbaja Platform is strictly intended for adults aged 18 and above. cbaja does not knowingly collect, store, or process personal data from any individual under the age of 18. Age verification is a mandatory step in the cbaja registration and KYC process, and access to the Platform is actively refused to individuals who cannot confirm they meet the minimum age requirement.
If cbaja becomes aware that personal data has been collected from a person under the age of 18, we will take immediate steps to delete that data from our systems and close the associated account. If you believe a minor has registered on the cbaja Platform, please notify us immediately at [email protected] so we can investigate and act without delay.
cbaja employs active age verification at the point of registration and before the first withdrawal is processed. Submitting false age information during registration is a serious breach of our Terms & Conditions and will result in immediate account closure and forfeiture of all balances. We take underage access to gambling platforms extremely seriously.
11 Updates to This Policy
cbaja reserves the right to update this Privacy Policy at any time. When we make material changes — such as introducing a new category of data collection, adding a new third-party sharing arrangement, or changing our retention periods — we will notify registered players via the email address associated with their account and will post a prominent notice on the Platform.
Minor updates (such as clarifications, grammatical corrections, or updates to contact details) may be made without prior notice, and the revised Policy will take effect from the date it is published on this page. The "Effective Date" at the top of this document will be updated to reflect the date the current version came into force.
Your continued use of the cbaja Platform after the revised Privacy Policy has been published constitutes your acknowledgement of the changes. If you do not agree with any revision, you should stop using the Platform and contact [email protected] to request account closure. We recommend reviewing this Policy periodically to stay informed about how cbaja protects your information.
For any question, concern, or request relating to this Privacy Policy or the data cbaja holds about you, please email: [email protected] with the subject line "Privacy Request". We aim to respond to all privacy enquiries within 2 business days and to resolve them fully within 30 calendar days.
Your Data, Our Responsibility
At cbaja, protecting the personal data of every player in Bangladesh is not just a legal obligation — it is a core part of how we operate. Here is what that commitment looks like in practice.
End-to-End Encryption
Every connection to cbaja is protected by 256-bit SSL/TLS encryption. Your login details, payment references, and personal information are always transmitted securely.
Strict KYC Verification
We verify the identity and age of every player before account activation. This protects our community and ensures the Platform remains exclusively for adults aged 18 and above.
Secure Data Storage
Sensitive records — including identity documents and payment references — are encrypted at rest using AES-256. Only authorised staff with a verified business need can access your data.
Consent-Based Marketing
cbaja will never send you promotional emails or SMS messages without your explicit consent. You can withdraw marketing consent at any time by emailing our support team.
Transparent Data Practices
This Privacy Policy clearly states every category of data we collect, why we collect it, how long we keep it, and who we share it with. No hidden data practices — ever.
Full Player Rights
You have the right to access, correct, delete, port, and object to the processing of your personal data. Submit a request to [email protected] and we will respond within 30 days.
Have Questions About Your Privacy?
If anything in this Privacy Policy is unclear, our support team is available around the clock to help. You can also browse our FAQ for quick answers, review our Responsible Gaming page, or explore the cbaja Platform.